Currently, a multitude of services are available to users over data networks such as the Internet. These services include information and interactive services deliverable over the network, and goods and services that may be shopped for and ordered over the network but are not deliverable over the network (e.g., clothing, food, etc.). Despite the plethora of available services and the apparent convenience for consumers of virtual shopping from electronic merchants or service providers (SPs), individuals are generally wary of electronic shopping and particularly, are reluctant to send credit card or other sensitive information over the Internet, since it is well publicized that personal credit card information should not be transmitted over a public data network, which may be subject to unauthorized access. It is also well publicized that individuals have cracked security coding mechanisms (e.g., RSA encryption) used in commercial software for secure communications on the Internet. It is therefore possible, for instance, that while en route to a targeted SP, encrypted credit card or other sensitive information may be intercepted at intervening routers by "hackers" or other eavesdroppers, who can decrypt the information.
Some providers of "non-electronically" delivered goods or services (e.g., goods delivered off-line; e.g., food, clothing, etc.) provide an option for avoiding sending sensitive information over the Internet by posting 800 telephone numbers that a user later calls off-line to pay for the goods or services which were ordered (but not paid for) over the Internet. This approach, however, is not only cumbersome, thus negating the appeal and purpose of virtual shopping and on-line purchasing of goods and services, but is also not suited as a payment method for goods and services (including information) which are delivered over the Internet (referred to hereinafter as "electronic goods"), and which are preferably delivered interactively in one session as part of a single transaction.
It may be understood that the lack of a secure transaction mechanism limits the further development of the Internet, the availability of service providers to users, and particularly the viability of smaller SPs. It is known that in addition to providing gateway access to the Internet and the thousands of small service providers around the world, large information service providers such as Prodigy, America Online and Compuserve provide their own information and interactive services. Users may also access the Internet and the thousands of smaller information service providers (ISPs) directly through smaller user-local Internet access providers. Generally, the large information service providers bill their customers on a time-usage basis after a financial payment relationship has been established, with the user/customer receiving a monthly bill which may include additional charges for usage of certain information and services and which is paid via the conventional postage system. Similarly, the smaller user-local Internet access providers usually also base their service charges to their subscribers for access to the Internet on a time-usage basis.
The smaller ISPs, however, currently either do not charge for access to their information and interactive services, or, if they do, also require the user to establish some sort of financial relationship whereby the user subscribes to the ISP and pays a bill via the conventional postage system. A frequent user of a particular established ISP may not be adverse to establishing a financial relationship for payment purposes. Typically, however, and in accordance with a fundamental concept of using the Internet (e.g., "surfing the net" using Web browsers which link websites by hypertext), a user accesses many different ISPs, each on only a casual and often unanticipated basis, and is not likely to want or be able to establish a plethora of financial relationships with so many different providers. ISPs that do or want to charge for access to their information and/or interactive services could do so by requiring the user to input their credit card number before data service is provided. Yet, as discussed above, users are loath to sending credit card information over the Internet, and therefore, would likely eschew such ISPs, who are typically smaller ISPs.
Accordingly, it may be appreciated that from the standpoint of the user/consumer, such a security and privacy risk effectively preempts the ostensible convenience of services available over data networks, and also limits the actual availability of information and interactive services to those which are free of charge or are charged within the purview of existing financial relationships (e.g., information from a user's service provider). From the standpoint of the SPs, the absence of a secure on-line billing mechanism limits the virtual marketplace, and its potential returns. In addition, the lack of a secure payment mechanism limits the number of SPs which can enter this marketplace, thereby limiting competition which would also likely benefit users/consumers.
There is a need, therefore, for improved secure communication methods over data networks, and particularly, for improved methods which provide enhanced security for users to send credit card or other sensitive information to Internet SPs.